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I consider the use of entanglement between two parties to 
enable one to authenticate her identity to another over a quan- 
tum communication channel. Exploiting the phenomenon of 
entanglement-catalyzed transformations between pure states 
gives a potentially reusable entangled identification token. In 
analyzing this, I consider the independently interesting prob- 
lem of the best possible approximation to a given pure entan- 
gled state realizable using local actions and classical commu- 
nication by parties sharing a different entangled state. 



I. INTRODUCTION 

The protocols to be presented in this paper give Al- 
ice and Bob a way of identifying ( "authenticating" ) each 
other, using quantum and classical channels. The pro- 
tocols are such that if Alice and Bob can successfully 
complete one, Alice is convinced that Bob (or someone 
who has stolen his identification token) is on the other 
end of the quantum communication channel. The clas- 
sical analogue of this can be done by having Bob re- 
veal, over a classical channel, a secret which Alice and 
Bob had previously securely shared. The quantum pro- 
tocols use shared entangled states as the counterpart of 
shared secret key. The quantum version of the proto- 
col differs from the classical protocol in potentially use- 
ful ways. At the most elementary level, it authenti- 
cates the presence of one quantum laboratory with cer- 
tain causal relations to another on a network. (This is 
accomplished using quantum information exchange; lest 
it be thought impossible, we note that this might also be 
accomplished via classical information exchange, using 
quantum nonlocality.) There is protection, via the no- 
cloning theorem, against copying of the authentication 
token. Similar ideas may provide theft-detection capa- 
bility, much as standard quantum cryptography provides 
security against eavesdropping. Most interestingly, the 
protocol based on using entangled "catalyst" states may 
provide reusable authentication tokens, although the se- 
curity properties when the tokens are reused will require 
careful analysis. 



II. THE TASK 

The authentication task considered in this paper is 
widely performed in practice, with computer login se- 
quences and automatic teller PIN protocols among the 
most common examples. It arises in settings where the 
channel is considered sufficiently tamper-proof by the 
users, but they wish to defend against a certain kind 
of "terminal" insecurity: the possibility that the work- 
station (or quantum lab) has been taken over by an im- 
postor. For this to be relevant to the authenticity of a 
session that follows authentication, there must be some 
assumption that control of the terminal has a high de- 
gree of intertemporal correlation. Perhaps there is some 
probability per unit time that the control of the terminal 
will be seized by an impostor. The probability of autho- 
rized control of the terminal then decays exponentially 
with time, but successful login-style authentication at a 
later time resets the the probability to one, which could 
provide (with a low enough decay rate) sufficiently in- 
creased security for a session bounded in time and start- 
ing with the authentication. Or, it may be assumed that 
once Alice is logged in, transmission remains authentic 
for the entire session; violations of terminal security are 
assumed to require stealth on the part of the impostor, 
and be infeasible (or low-probability) until Alice has left 
the terminal. 

Such protocols are sometimes used as a prelude to fur- 
ther communication, for example in a login sequence for 
remote use of a computer. Without assumptions such 
as those of the previous paragraph, these protocols do 
not provide a solid guarantee of authenticity for the rest 
of the session. Someone could allow you to log in, then 
block your access and tap the line for their own purposes. 
Demonstrating authenticity for the entire session in the 
presence of such a threat requires methods such as the 
protocol based on universal hash functions |2,||. (Such 
protocols are used, for example, to authenticate the clas- 
sical communication involved in quantum key distribu- 
tion protocols.) In these protocols the degree of security 
associated with shared secret key bits may be transferred 
to the authenticity of the message, by hashing the mes- 
sage and the secret key using a certain type of universal 
hash function, and sending the hash along with the (un- 
encrypted) message over the public channel. The receiver 
then hashes the message with his copy of the secret key, 
and compares to the sent hash; tampering (with either 
message or hash or both) by someone without knowledge 



of the key is overwhelmingly likely to yield a tampered- 
with hash which is not the valid hash of the authentic 
message. 

Whether the authenticity of the quantum authentica- 
tion tokens discussed in this paper, which are a coun- 
terpart of the classical notion of shared secret key, can 
be transferred to an entire communication session in 
the manner of the universal hashing protocol described 
above, is an extremely interesting question. A simple 
adaptation of the classical protocol would seem difficult 
in the case in which the user who logs in may wish to act 
as a conduit for quantum states unknown to her, since 
the hashing protocol requires two copies of the message, 
one to be hashed and sent and the other to be sent unal- 
tered. The preparation-visible case seems more promis- 
ing, although this is a severe restriction. 



III. QUANTUM AUTHENTICATION USING 

ENTANGLEMENT 



Rather than using a shared classical secret, Alice and 
Bob authenticate via a shared entangled quantum state. 
Unlike the key in a classical scheme, this quantum key 
need not be secret, although keeping it secret might make 
it harder to steal (particularly if it is not maximally en- 
tangled), and might have other advantages in a many- 
user setup. Perhaps the simplest scheme is for Alice and 
Bob to share some maximally entangled states; Alice, at 
least, knows which states. To authenticate. Bob sends 
Alice his half of some of the states; Alice then performs 
tests on them to assure herself they are indeed the speci- 
fied Bell states. Say they are all the same Bell state; Bob 
sends N of them, and Alice measures them in the Bell 
basis; by increasing N, she can distinguish these states 
more and more reliably (at a rate which depends on the 
noise in the overall process) from any states that could 
come from an impostor which are actually not entangled 
with her states. In fact, in a d-dimensional Hilbert space 
the maximum matrix element (iplplip) for a separable p 
to pass a test for being a maximally entangled {tp) is 1/d 
(this occurs where p is pure, and is any one of the prod- 
uct states occuring in the Schmidt decomposition) . Thus 
security increases exponentially in the number of qubits 
(log2 d) used. 

The quantum scheme differs from its classical counter- 
part in several potentially useful respects. With a clas- 
sical secret, an impostor would have to break into Bob's 
classical storage area and copy his secret key; it is phys- 
ically possible to do so without evidence of the break-in. 
The impostor and Bob could both communicate with Al- 
ice, who might not realize anything was wrong for quite 
a while. Both would be able to authenticate. By con- 
trast, an impostor who stole Bob's half of a quantum au- 
thentication key would have to be able to always divert 
the authentication portion of a communication session to 



himself, should he wish to allow Alice and Bob to commu- 
nicate unaware of the loss of their authentication token. 
The quantum scheme is also more directed: steal Alice's 
classical (symmetric-crypto) key and you have what Al- 
ice and Bob share; steal Alice's half of an entangled state 
and you still can't pretend to Alice that you're Bob. The 
no-cloning theorem not only makes undetected theft of 
key more difficult, but also protects a stolen key from 
dissemination to wide sectors of the underworld. Steal 
Alice's classical key, and you can distribute it to your 
henchmen all over, who can pretend to be Alice when 
and where they want. Steal her half of an entangled 
state, and there's no way of distributing it among your 
henchpeople (or henchthings, for that matter). 

Either the maximally-entangled-state quantum au- 
thentication protocol or the classical shared-secret pro- 
tocol uses up some of the shared key each time authen- 
tication takes place. By contrast, a catalysis protocol 
does not. The fact that the shared key is (or can be) 
used up each time authentication takes place renders the 
EPR protocol better for certain purposes: for example, 
for banknotes it could be good that the state is returned 
to the bank and destroyed in the authentication process. 
Such entangled "money" would have the desirable prop- 
erties of transferability and uncopyability, but not the 
properties of untraceability or anonymity, nor does the 
present discussion provide a protocol for verification of its 
value, let alone nondestructive verification of its value, by 
third parties; it is far from constituting proper quantum 
cash. Schemes more suitable for quantum cash were pro- 
posed by Wiesner S and Bennett, Brassard, Breidbart 
and Wiesner B; they involve nonorthogonality rather 
than entanglement. For other purposes, however, it may 
be good to have a reusable i.d. token. The catalysis 
protocol presented in Section |V| may provide such a to- 
ken. The next section provides background for the un- 
derstanding of catalysis. 



IV. LOCC-CONVERTIBILITY AND CATALYSIS 

Nielsen showed that a pure state ji/') in a Hilbert 
space A ^ B is convertible to another, \x), by local ac- 
tions and classical communication (LOCC), if and only 
if the nonincreasingly-ordered eigenvalues of the reduced 
density matrix of \x) majorize those of \ip). (These 
are sometimes called the OSC's, ordered Schmidt co- 
efficients, of the pure states. I will use the notation 
•^i(l^)('7l) fo'' the ordered eigenvalues of the reduced den- 
sity matrix of |?7)(?7|, rather than for those of the den- 
sity matrix of \'ri){i]\ itself as in more standard notation.) 
That is, the target state's reduced density matrix is "less 
mixed" ; it is natural to suppose this means it is less en- 
tangled, and the theorem confirms this intuition. I will 
write this relation (which is a partial ordering on the 
pure states) \x) ^ IV'), and write \ip) (x: \x) when nei- 



ther |'0) ^ Ix) nor |x) < |^). (The relation "^" may 
thus be read "is less entangled than.") I will also use 
the obvious ordering this induces on one-dimensional pro- 
jectors on these states, and extend it to density matri- 
ces in the manner of Vidal M. He defined d — 1 en- 
tanglement measures Ek, which are sums of the k low- 
est Schmidt eigenvalues, and are nonincreasing under 
LOCC. Define Sk{\vM) - Eti ^^i\v){v\) ■ Also define 

Extend this to mixed states via: 

Skip) ■■= max Xl^J'^fe(I^J^^^jl) ■ (^) 

{tj,\nj)\2^-tj\vj){vj\=p} j 

Equivalcntly, one could define 

Ekip)-^ min J2*jEk{\il,){ii,\) . (2) 

{tj,\vj)\2^.tj\vj){vj\=p} j 

Define 



Pi h P2 ■.^yk,Ek{pi) > Ek{p2) 



(3) 



This is the extension of the majorization-based "more en- 
tangled than" relation to mixed states. Vidal P] showed 
that the Ek-d+i '■= 1 — Sk are entanglement montones, 
hence cannot be increased by LOCC. Jonathan and Ple- 
nio I?! state (indeed, they make a somewhat more gen- 
eral statement; cf. also [g) that the partial ordering (|^) 
in fact coincides with LOCC-convertability. This is, of 
course, a generalization of Nielsen's theorem to mixed 
states. Jonathan and Plenio [g[ have used Nielsen's The- 
orem to show the existence of pairs of states jf/)) ixi \x), 
such that if Alice and Bob share a particular entangled 
state 10), they may nonetheless convert |^) into |x) by 
LOCC, while retaining \(f>) unchanged at the end of the 
process. In this paper, this phenomenon is exploited to 
give a potentially reusable quantum identification token. 



V. THE CATALYSIS PROTOCOL 

Here, Alice and Bob share a catalyst state \4>). There 
are incommensurate states \4>i) and |02) such that in the 
presence of the catalyst, \(j>i) can be converted to \4>2), 
while retaining \(p). For Bob to authenticate himself to 
Alice, Alice makes {(pi) in her laboratory, and sends half 
of it to Bob. They then go through the steps, involving 
local measurements, one-way communication of measure- 
ment results, and local operations conditional on those 
measurement results, which convert |0i) to \(f>2)- If Al- 
ice's quantum channel leads to a cheating Derek, who 
does not possess any subsystem involved in the catalyst 
state, by Nielsen's result this conversion cannot succeed. 
So the protocol continues by having Bob return to Al- 
ice the B half of the system which they were to convert 
into 102). She then measures the projector onto |02). If 



(with the idealization of perfect operations and measure- 
ments) she ever gets the result "0" , she knows that Bob 
was not involved in the protocol (assuming Bob would al- 
ways implement the protocol correctly were he involved) . 
Usually, even if an impostor is involved, the measurement 
result will be "1" . But the small probability of "0" in that 
case can be amplified by repeating the protocol. This has 
no cost in the stored catalyst state, though it has a cost 
(polynomial in the desired accuracy) in quantum com- 
munication. 

A weak upper bound on the one-shot probability of 
error (of getting "1" from an impostor) can be gotten 
by considering the (convex) set of less entangled states 
(those whose OSC's majorize |0i)'s). Let p* be the clos- 
est of these states (in the Li norm distance which corre- 
sponds to error probability) to 102); thenpe — (02|/3*|02)- 
This can be used to obtain, for a specified e, an expres- 
sion, polynomial in I/e, for a number of repetitions guar- 
anteed to give error probability below e. It is a bound 
because only the less entangled states are accessible via 
a protocol between Alice and an impostor Derek unen- 
tangled with those of Alice's systems involved in the pro- 
tocol. It is a weak bound because choosing the nearest 
of those states means considering Alice as conniving with 
Derek to fool herself. In the actual situation, Alice will 
not perform her part of a protocol for converting |0i) to 
10*), but rather will still perform her part of the protocol 
for converting |0i) to |02). As Chris Fuchs pointed out to 
me, when Alice does the correct protocol in the presence 
of the impostor, she will of course wind up with the same 
reduced density matrix she would have if there had been 
no impostor; i.e., the reduced density matrix of |02)- So, 
we may now look at the closest state, not merely among 
the less entangled states, but in the (still convex) set of 
less entangled states having the same density matrix for 
Alice as |02)- Since |02) and local unitary transforma- 
tions of it are not in the majorized set, the closest such 
state will be mixed. 

Our weak bound on the error probability is given by 



max (02|/3|02) 



(4) 



This problem would be very much simplified if we could 
assume the optimal state p* were pure, but it is not ob- 
vious this should be so. It is clear that the majoriza- 
tion constraint on p prevents us from attaining 1 in this 
maximization, but in order to use the protocol in a par- 
ticular instance, we need an upper bound below 1. One 
more tractable upper bound comes from considering the 
d~l maximization problems in which only one of the ma- 
jorization constraints is imposed, and taking the lowest 
of these maxima. 



min max/(/9) := (02|/5|02) 

k—l d—1 



subject to 
Ekip) < Ck . 



(5) 



Here ^fc := ^fc(|</'i)(</'i|)- Because of the definition of Ek 
as a minimum over ensembles, we can recast the inner 
maximization as a maximization of / over all ensembles 
of pure states: 

max/(si, ..., s„, |77i), ..., |7?„)) := ^ Sj|('/'2b7j)P 

j 

subject to 

J2^jEk{h){Vj\)<Ck. (6) 
j 

Here Sj are probabilities, and \rij) pure states, n may 
vary, but there will be a bound from a Davies-type argu- 
ment. Moreover, there will be a maximum for which all 
the states \rij) are Schmidt-codiagonal with \(j)2)- This 
follows from two observations. First, Lemma 1 below, 
which implies that each term in the objective function is 
maximized (for fixed Qj), by an \r]j) Schmidt-codiagonal 
with \(j)2)- Second, the fact that the local unitary trans- 
formation required to get an arbitrary \r]j) into that form 
has no effect on the value of the constraint function, since 
Ek is invariant under local unitaries. 
Lemma 1: 

For fixed Schmidt coefficients, the pure state |x) which 
maximizes Kf/^lx)!^ has the same Schmidt basis as |(/)). 
Proof: 

We show this by mapping the pure states of the 
d^-dimensional system AB onto operators on a d- 
dimensional Hilbert space, in such a way that the inner 
product in the tensor product vector space becomes the 
Hilbert-Schmidt inner product of the operators. Denote 
such a map by a, and use the notation 



Then 



^(|X)):=G, 



(^Ix) ^ tr gIg 



(ji'-'X 



(7) 



(8) 



We may change to an arbitrary Schmidt basis by local 
unitaries. In this formalism, and writing the reduced 
density matrices as (pi and x respectively, unitaries cor- 
responding to changing |x)'s Schmidt bases in the A and 
B system are mapped, one-to-one, onto unitaries U and 
W such that G^ = Ux^^'^W. Let x and 0i be diagonal in 
the same basis, for simplicity; by varying over U and W 
we vary over G operators corresponding to all Schmidt 
bases, for given eigenvalues. Thus 



ma.XunitaiyU,w\i^<l>iUx^^'^W\ 
-- maxunitaryy.yK'/'ilV^^'^^lx)! • 



(9) 



A result of Von Neumann ild,ll| states that this max- 



imum occurs where 



aV2 



and x^^^ a'1'6 codiagonal, and 



their eigenvalues are matched in order of size. This proves 
Lemma 1. 



Now we show that there is an ensemble solving (g) 
which contains just one pure state. As just argued, we 
may confine our attention to ensembles of states Schmidt- 
codiagonal with 102)- Thus, the squared inner products 
whose average is the objective function in m) are just 
squared Bhattacharyya overlaps 



S'(p,q):=(EVP^)' 



(10) 



between the Schmidt eigenvalues pi of |02) and those (qi) 
of the states lijj); since B^ is concave in one argument 
||l2| , replacing the Sj -ensemble by the vector with the 
Sj-averaged Schmidt coefficients will increase the objec- 
tive function. Moreover, this will keep the value of the 
constraint function unchanged. To be explicit, define 



are the ordered Schmidt coefficients of \rij). 

i('/'2i^>r = (E^ ' 



where 
Then 



i \ j j i 

^E^^K'^2ir7,>r (12) 

while (for any k) 

k k 

Sk{\ri){v\) = E^E *j*j) =" E *j(E *j) 

= E^j-^^(i'?^X'?^i)- (13) 

This argument doesn't immediately extend to the 
multi-constraint problem. Each Ek is defined by an inde- 
pendent minimization over ensembles; therefore one can't 
recast the multiconstraint problem as an single maxi- 
mization over ensembles. 

If we nevertheless assume the solution is pure in the 
original multi-constraint problem, it reduces to: 




-q, < 
^g,-l<0 



(14) 



where pi, qi, r^ are the reduced density matrix eigenval- 
ues of |(/)2), Ix), and |(/)i) respectively, and Cfc := Y.i=i "^k- 



Since the objective function is concave in q and the feasi- 
ble set (since it is given by a conjunction of hnear inequal- 
ities 5i(q) < 0)) is convex, the Kuhn- Tucker conditions 
are necessary and sufficient for a maximum [|3| as long 
as constraint qualification holds. These are: 



5/(q) 



Ea^ 



%(q*) 



(15) 



Here Xi > 0, with Ai = for slack constraints. 

In our problem the objective function /(q) := 
J2i VPili ^^^^ derivatives 



5//% = (l/2)v^ 



qi 



(16) 



The positivity constraints on the qi will be slack because 
the partial derivatives go to -f oo at qi = 0. 

Here is an example of the weak bound, using states 
from |£|. These are: 

|0i) = VoilOO) + V0A\11) + V(n\22) + V0T|33) 

102) = \/(I5|00)+\/a25|ll) + \/(125|22) . (17) 

We will make the assumption that the optimal state is 
pure, which will turn out to be correct in this particular 
case. If we start with \(j>i) and reallocate Schmidt co- 
efficients from lower-weight to higher-weight basis states 
(so that the resulting state "majorizes" \4>i), it is clear 
we should take all of the weight from |33) and move it 
to a higher-probability state, say |22) to get its proba- 
bility closer to P2^s. I chose to allocate it to 92 because 
the derivative of the objective function was largest with 
respect to 52, even after the reallocation of all of q^ to 
it. No further increase in (72 is possible, since the weight 
would have to come from go or gi, and that would vi- 
olate the majorization constraint qo + qi = 0.8. Real- 
locating that 0.8 optimally between the go and gi (by 
equating derivatives of the objective function with re- 
spect to them) yields go = \/8/15, gi = y/i/lb. There is 
(of course) still no advantage to reallocating g2 to either 
of the larger probabilities, since df/dq2 is still the largest 
derivative. Thus 



Ix*) = V87T5|00) + V47l5|ll) + \/0:2|22) . (18) 

Hence pe = |(xl02)P = .9964102.... Moreover, here the 
only binding majorization constraint is go + gi > 0.8. 
Therefore, this also solves the problem with that con- 
straint alone, and so provides a genuine upper bound 
on the protocol's error probability. This is, of course, 
quite high, but since the error is one-sided it can be ex- 
ponentially suppressed by repetition. For example, after 
two thousand repetitions we get Pe = .0007522.... Still, 
computation of the stronger bound obtained from con- 
sideration of Alice performing the actual protocol is ob- 
viously desirable. For practical purposes, it might be 



very useful to find examples of catalyzable transforma- 
tions \4>i) —^ I (^2) for which the error probability of any 
local approximation of the transformation is bounded 
much further below 1. It is natural to look in higher- 
dimensional systems for such examples. Such pairs of 
states must be incommensurable, and Nielsen has conjec- 
tured that incommensurability approaches being generic 
in high-dimensional systems. Whether catalyzability is 
equally common (or whether it is measure-zero even for 
finite-dimensional systems) is an interesting question. 
The distinguishability of a maximally entangled state 
from the separable states increases with dimensionality, 
with error-probability approaching zero. It is natural to 
ask whether the error probability for distinguishing states 
locally produced from a given state from some state lo- 
cally producible only with the aid of a catalyst may be 
made to approach zero in some sequence of examples of 
increasing dimension. 

Whatever the ultimate judgement on the catalyzed 
protocol from the cryptographic standpoint, the opti- 
mization problem discussed in this section, of finding the 
closest approximation to \(f>2) obtainable by local quan- 
tum operations and quantum communication, given the 
state |0i), is of independent interest. 



VI. SECURITY 

How secure is this protocol? The error probability 
above gives a measure. Since Alice may destroy her 
test states (the ones to be turned from |0i) into |(/)2)) 
after each use, coherent eavesdropping involving these 
states may seem unlikely to be of any use in corrupting 
later uses of the protocol. However, one must investigate 
whether a Derek able to divert some of the quantum com- 
munications, and possibly also impersonate Alice or Bob 
during the classical discussion^ could redirect the cata- 
lyst state to himself and use it in later rounds. If Derek 
is a true man-in-thc-middle, he could receive Alice's test 
state, keep it, and send whatever he wanted to Bob. (He 
could even send half of a {(pi) state.) If he could also 
impersonate Alice and Bob on the classical channel, then 
he could in fact do the protocol with Bob (who would 
be using half of a Derek-supplied |0i) state). He could 
then send the resulting |(/)2) state on to Alice. But that's 
not "really" a problem with the protocol: Alice is indeed 
identifying herself. (Of course, Derek can jam her ability 
to i.d. herself, if he has this setup, but mcn-in-thc-middle 
can always do that.) But can Derek steal the catalyst? 



^Classical hashing techniques could be used to prevent this, 
but this would require using up classical secret key, and, if 
crucial to security, might obviate some advantages conferred 
by the quantumness of the remainder of the protocol. 



It's somewhat plausible that he could. For, he can send 
whatever state he wants to Bob (even one entangled with 
a system Derek keeps) , while keeping the state Alice sent 
him. Bob will measure this other state jointly with his 
end of the catalyst, and broadcast the result. Bob will 
even send the noncatalyst part of the measured system 
back to Derek. The basic elements present (entanglement 
between Derek and Bob, joint measurement by Bob of 
the system entangled with Derek and Bob's part of the 
catalyst, and broadcast by Bob of the measurement re- 
sult) are also present in a protocol for teleporting Bob's 
part of the catalyst state to Derek. There is of course no 
guarantee (and probably no particular reason to think) 
that this is such a teleportation protocol. Quite possibly, 
anything Derek does to steal the catalyst will be likely to 
make the conversion procedure fail (after all, the simplest 
procedure for ensuring its success, which is for Derek to 
just act as a conduit for \(j>i), cannot steal the catalyst). 
But a full analysis is required before claiming that the 
catalysis protocol is secure when reused (and reuse is 
necessary just to get the error probability acceptably low, 
in the example given above). It seems almost too good 
to be true that a phenomenon such as catalysis, closely 
linked to properties (e.g. incommensurability, in the op- 
erational sense of non-interconvertibility via LOCC) of 
finite-dimensional quantum states that disappear when 
the tasks defining them are defined asymptotically on 
large numbers of copies, should nevertheless be usable 
by repetition to achieve asymptotically useful results in 
a cryptographic task. But quantum information has sur- 
prised us before. And even if repeated authentication via 
catalysis turns out not to be secure, knowing this (and 
knowing why) will shed light on the phenonomenon of 
catalysis and related information-theoretic concepts and 
tasks. 

The teleportation attack scenario is not so worrisome 
in the case in which only "terminal security" is at is- 
sue, which is the one in which using the login protocol 
as a prelude to further communication makes the most 
sense. Nevertheless, it is worth investigating, if any level 
of channel insecurity exists: it would enable channel inse- 
curity to become terminal insecurity over time. Also, in a 
model with no channel insecurity, it is questionable why 
one would want to use the catalysis protocol instead of 
the maximally-entangled protocol. For then the problem 
of using up the supply of entangled key may be solved 
by sharing more entangled states over the (supposedly se- 
cure) quantum channel during the period of high terminal 
security initiated by authentication. With any terminal 
insecurity, the security of the currently-used entangled 
states will decay with repeated sessions (some of the new 
entangled states may occasionally be transmitted to an 
impostor). Possibly this is not so for the catalyst states 
even with some terminal insecurity during a communi- 
cation session, since once shared the catalyst states are 
never retransmitted; here, again, teleporting attacks are 



the issue. 



VII. CONCLUSION 

I have given some protocols with which two parties may 
share an entangled quantum state, and use it as a secure 
identification token. The simplest protocols just involve 
sharing a maximally entangled state of high-dimensional 
quantum systems; authentication is accomplished by one 
party's sending the other her half of the state, which can 
then be distinguished by measurement from anything a 
disentangled impostor could present. Advantages over 
classical shared secrets might include theft detectability, 
uncopiability, and of course the ability to authenticate a 
quantum laboratory's presence on a quantum network. 
The possibihty of a protocol based on the abihty of some 
shared entangled states to catalyze certain transforma- 
tions between other shared entangled states (which would 
otherwise be impossible by local actions and classical 
communication) was also introduced. This occasioned 
some analysis of the problem, interesting in itself, of the 
best LOCC approximation to such a transformation. An 
interesting potential advantage of the catalysis protocol 
is repeatability without using up the identification to- 
ken. Showing the security, or lack of it, of repeated use 
of this protocol could illuminate several interesting areas 
of the theory of quantum information and entanglement, 
in addition to shedding light on nature of the curious 
phenomenon of catalysis. 
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